f9c00847d3ad3ae22839c40efb318bdf354d631ec4ff6ab3040c2f7f7c6583f5

Analysis

max time kernel
117s
max time network
152s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 02:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

250fab14782685f8545b45a17adb5e34.html
Size

954B
MD5

250fab14782685f8545b45a17adb5e34
SHA1

af39cec2d66364a5e33b89e0657c66081e2ee8a6
SHA256

f9c00847d3ad3ae22839c40efb318bdf354d631ec4ff6ab3040c2f7f7c6583f5
SHA512

12ca095ba4bcfcf280b600d5a1404bfc7ca7ae58270206cab0a41c3d8d381c0c023c879ec58a744c2b2697324fa4b3b0097be49485cd95d3084f88606781347b

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6C3F09D1-A904-11EE-88F9-76B33C18F4CF} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb80000000002000000000010660000000100002000000021504cefd4f911dc13435364c721546e94dc1016ac4def366aa3fed178ddc8b1000000000e800000000200002000000071c1ddd1118a3f8c52282077dd452be4e38c84aa24d8c3a2fbd541c36b9901de20000000d979c5ac4a4f79d673d3e42195443edbb36c376b0b727eb7520b85af164f28ba4000000098dd11312a3f74b25c08c4b273e1acf3ef31b7741dd28b1296cbcd73f336297d87a8100a2f663bf4e3b1293e9d2c71189197ed06d7d29150419e30d990f664fd	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0338941113dda01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb80000000002000000000010660000000100002000000012a96ed372dd2db560a3afb5139556aeca9370b409bc2e6f50a8ef07f7a165b4000000000e80000000020000200000002bd28681124c685a0aa4072ce141d062b9391c61e69d0e76ae12d659ddb3a06e900000007e80bf0ff20651694a5c85434306365d8a35b7ffd643162a06693250296bfc122fc3d743c548bfa24943d330423f8f1e79386c2b3b7356d796fd0ad3c6d96818cbc1eca55c1f3a5426a8d8423bdd4421ea0b818f7ad9113aa40e1cb7d7f09d38efeecf798a3290405f556f46563beed664d61e59091aa9d350ee90036192cc812c5b73911bcc496c92c3450cee2e029e400000003c6e4d06fed2c02e3b7d6d925d4987f1194a46f7cb6ac8fe2feff5d79b2fc401947a6438cba324be0f779576167e38e0c8f09c2770ba0935ce326ae86c02569c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410316581"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1968	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1968	iexplore.exe
1968	iexplore.exe
1112	IEXPLORE.EXE
1112	IEXPLORE.EXE
1112	IEXPLORE.EXE
1112	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1968 wrote to memory of 1112	1968	iexplore.exe	28
PID 1968 wrote to memory of 1112	1968	iexplore.exe	28
PID 1968 wrote to memory of 1112	1968	iexplore.exe	28
PID 1968 wrote to memory of 1112	1968	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\250fab14782685f8545b45a17adb5e34.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1968
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1968 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1112

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
51f58b85422ae5c2736a479edb3ef0e5

SHA1
e09bc31f5ee3bb28de665e0da0f53c38a51e9cc0

SHA256
dbef798f6293b119eace1f383fe7d39c79539b7c5015795a27cccf258970a5c7

SHA512
affd5e969380311d31e27e769a2227cf40f21c30e8babca93f8ecb8e056a39112538b655e826fbd64d475ff5155d3c508ab7d956fb8f3893e96669da363ea128

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fc3a0bcc59fdc1c3683ccc3f6a3f2150

SHA1
1e83a252df14e0bf16a0d907d74b1fac189b28b2

SHA256
2d294561b155ae88fb0aaf51b2f9b6a1828575f01135e839144984b0c9f32fd0

SHA512
6b3dfff0b83ce361153affed0d6e1e25cde4d666e90aa7ee741fc8531f8c082e0559b1af4417a62d8a298c85253d51d522483fbcb36c2f3335bdf96e0abdeb48

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c05aad4c166208e3ec1be59768cfb671

SHA1
425e9c59205df3f2f721c8c6fd4375ef11cb2e30

SHA256
457e1d6ba6a9563fd4a4be5095fa6332200446ff851c0a59ec2016581ee0c5da

SHA512
9f7d0c5e9f3538828fb9cde91bbf68453935cfa28a2981ad191a1de9b29ef644053d459461a9a57de3fc9b41f0d4235b27ae6fe6ec0618e3eadb52be7dc5623d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c55902be3cb24a5b3d424e806db794e4

SHA1
87a936042f59e8a54a25b46569c69881ee1345f9

SHA256
bbbfc05892fb580276d693109e427e198e6d69a54b49b2e9dc0a996ec9bda3d6

SHA512
1d231531d8066000d7b4a501882f118986c02f4674bcb1ff3f635e6c5c7de59d09e348cbd34649fdfee6eff49b7a0d73d8a412ab4689167d447b468b4a7efcfd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2e264b7e869824a17e15014734be64cc

SHA1
c84cb5e15bb9318bd8957127084c3e0412d703a7

SHA256
af65bf85820056b3fe38eeb09f25e12f2cdc36f176870d3fc54771ca84abffbe

SHA512
dceab6c39648264e14b682ee10038dc8bcb6e5101221b39188a2bea9f6652564f99a6cc9db0b0f040c5de35a49a6891b637fe18e9e13bb4c1ae9a93ddd919744

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fad8b6386ceb6da35d555c6a529d7260

SHA1
c98eb94b51619bff4f04190625e945fab2546f3d

SHA256
792af08afbd06591196716c8d2746e3423f6f0bc4e22c40a57a0c81693faa031

SHA512
018483c74cb3090081f8df915fe7953fae136d4738b75d77620be624bdf2fabf64fa83f600a8376f0b0ee6300e6c9bd8ec89d63c18b82a0bc056f3d7c23e383b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dd95ef28a06092d52d559068b407bdc9

SHA1
f9138fcc352e534e65953cc72ba29afedc1fc157

SHA256
2e03185f97fec9871183fc415eb0b4215f82ddea3ca0f48b3f38c41f81a72503

SHA512
0be19676047d5aee226408351741de78b6086ce2f05e81924103143db798bf9ec282a564cb5bee4a7fb1b1f4d41b759b4c0df6d09aa4d2b57bb021c141bf2a53

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8c514926ba1e8ef91ab20994eaad82ad

SHA1
8696287602b50bab84d993cf333c368cc9afff22

SHA256
37c8ef636ef79dd61c78059be9aa51ce8eb9c6f5143c582987c45b1869b87215

SHA512
36645fdeb68220bd5c8fab720144b60d2f814690738d93bc27750e4f9d2d7d2062daba6c98a9da84e08e9e5af82f1d829c3f68275608ad4a554966db5377889c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c45c3d5d656c5fbaf34a23bf6c4c9903

SHA1
48f48476edc2d10a5829c746c25b0cac576a7e9a

SHA256
cfbd273e54777a2e9203d3b1935c5cceef8463cb4c0199589fb41362fd0bb9f7

SHA512
fab84082d57d2e6cb2b53887c85e149b4e9441e3cc896b56f2f22c1e2d7584966f2074e073c3b140811f492eb1c7d7a8809b2a173ff5e4eb07f6a1f87862b484

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC016.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC5F4.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit